Privacy Policy

Questions about your data and deletion requests: support@whenera.com or the feedback form.

• Account: email, nickname, password hash (the password itself is never stored), avatar. With Google sign-in — your Google account id, email and profile picture.
• Guest identifier: the `hg_guest` cookie (up to 1 year) — keeps your progress, streaks and card history before you register.
• Gameplay: sessions played, answers, scores, completion times, likes, collection, packs you create.
• Feedback: your message, the reply email (if you leave one) and technical context — page, language, viewport, last game.
• Visits: pages viewed (path with query string and referrer), a per-visit id — aggregated under your account or guest token.
• Technical data: session and language cookies, theme preference in localStorage; your IP address is processed for abuse protection (rate limiting).

• running the service: progress, streaks, leaderboards, the Daily Cup;
• carrying guest progress into your account when you register;
• in-service notifications;
• product analytics — which modes get played and where people drop off, to improve the game;
• moderating user content and preventing abuse.

Consent given at registration (the checkbox accepting the Terms and personal-data processing); performance of the Terms of Use (your game progress); legitimate interest — product statistics and service security.

Only first-party functional cookies are used: `hg_guest` (guest progress, 1 year), the account session (30 days), `lang` (interface language). Local storage holds theme, completed tutorials and settings.

No advertising cookies or third-party trackers — all analytics runs on our own infrastructure and never leaves the server.

Data is never sold or shared with ad networks. Processors: the server and database hosting provider; Google — only if you sign in with a Google account.

Card images load from external sites (Wikimedia Commons, museum and archive websites): fetching them exposes your IP address and referrer to those sites — the same as visiting them directly.

• account — until you delete it;
• guest token and linked sessions — up to ~1 year of inactivity;
• the analytics event stream — 90 days;
• feedback submissions — up to ~1 year;
• database backups — limited time under the backup schedule.

• view and fix your data in your account;
• request an export or deletion of your account and related data — write to support@whenera.com from your account address;
• withdraw consent by deleting your account (processing before withdrawal stays lawful);
• complain to your local data-protection authority.

The service is not directed at children under 13 and does not knowingly collect their data. If we learn of an account belonging to a child under 13, we will delete it.

The current version always lives on this page. Material changes will be announced with an in-service notification.